THE COMING OF AN ORWELLIAN STATE
Last week, the Indian State put on a rather harrowing display of its police powers as it responded to protests around the new citizenship law with curfews, internet shutdowns and police violence. Around the same time, it offered us another example of disproportionate state control over individual rights and civil liberties through the new personal data protection bill.
A data protection law is meant to safeguard our privacy and should ideally give us more control over our personal information. But the version of the bill tabled in Parliament last week empowers the central government to exempt any government agency from some or all of its provisions through a simple notification. The government can exercise this power on many grounds, including public order and security of the State. This means that the Indian State wants to be able to choose when and to what extent it wants to respect individual privacy—a fundamental right. Ironically, this bill was born out of the commitment made by the government to the Supreme Court, during the right to privacy litigation, that it would enact a law to protect an individual’s personal information and privacy.
The government’s version of the data protection bill departs from the version put forth by the Justice B.N. Srikrishna committee in 2018 in several key aspects. The new bill allows the government to exempt itself from the law; determine what information must be stored and processed in India; mandate companies to share anonymised personal as well as non-personal data; and appoint members of the Data Protection Authority of India, envisaged to be an independent regulator, on the recommendations of a committee of secretaries (IAS officers) with no judicial or independent members.
What common theme cuts across all of these changes? Increased government control over individual personal information and as a corollary over civil rights and liberties. While the consequences of such control might not be obvious on the face of it, they are far-reaching and all the more dangerous for this very lack of apparency. Take, for instance, biometric data, which includes facial images, fingerprints and iris scans. Under the new bill, the government may notify some kinds of biometric data that may not be processed unless allowed by law. This allows the government to ban the processing of some kinds of information altogether, or to specify the conditions under which it may be processed. But what happens if the government chooses to exempt itself from this provision altogether?
Multiple government programmes and agencies currently use biometric information. These include the various government agencies who are a part of the Aadhaar universe; the National Crime Records Bureau and all law enforcement authorities interfacing with the National Automated Facial Recognition System; all police stations and other law enforcement agencies that routinely collect fingerprints at the bare minimum; airport authorities using facial recognition technologies for checkin, security and border control; multiple state and city governments deploying CCTV cameras and linked databases; and government schools, colleges and offices using biometric attendance marking systems, to name a few.
The government could choose to not let any of the above or any other government programme be subject to the restrictions on the processing of biometric data, any of the heightened data-protection requirements biometric information is subject to by virtue of it being sensitive personal information, or even the most basic safeguards applicable to all personal information such as notice and consent. In effect, various government agencies could collect our biometric information without our knowledge or consent and not tell us what is being done with this information. As Smriti Parsheera notes in her paper for the Data Governance Network, the unchecked use of new technologies using biometric information presents a “real and immediate threat to our privacy and other civil liberties”.
It comes as no surprise that Justice B.N. Srikrishna is worried about India turning into an Orwellian state. As countless others have said, judicial oversight of government access to information is non-negotiable. Unchecked government powers have no place in a modern democracy. ■
The government’s version of the data protection bill exempts it from the law, giving it unrestricted access to personal data